LexLint.ioBeta

Know the law your code answers to.

Law / Ghana

Critical Information Infrastructure Directive, Baseline Cybersecurity Requirements

CII Directive (CSA, 2021) baseline requirements, paras 5.1, 5.2 and 7, Directive for the Protection of Critical Information Infrastructure

In force since .

A sector security regimes rule binding public and private bodies.

Private right of action
No
Instrument type
a regulation made under an act
Obligation class
Security, Governance, Reporting

As of .

What it requires

  • This binds every designated CII Owner, meaning the legal owner or operator of a critical information infrastructure designated by the Minister under section 35 of the Cybersecurity Act, 2020, in the thirteen designated sectors, among them banking and finance, information and communications technology, energy, water, transport and health (reached by declaring that you operate an essential service).
  • Develop and implement a cybersecurity policy that addresses the risks of your critical information infrastructure, and review it at least once a year (paragraph 5.1).
  • Appoint an accountable officer of senior management rank for cybersecurity governance, policy and strategy (paragraph 5.1).
  • Conduct a quarterly cybersecurity risk assessment, conduct yearly cybersecurity audits, and create and keep a cybersecurity risk register (paragraph 5.2).
  • Submit copies of your audit reports, risk register and cybersecurity activity reports to the Authority as the Directive requires, and seek the Authority's clearance within one month before any major organisational change in operation, personnel and infrastructure (paragraph 7).
  • Comply with any additional directive the Authority issues to you without notice (paragraph 7).

These lines are LexLint's reading of the law's text, as of .

Who enforces it

Enforcement body

The Cyber Security Authority, established under section 2 of the Cybersecurity Act, 2020 (Act 1038).

Settledness

As of
Open questions
Is a given business a designated owner under the Minister's Gazette notice, which the Directive refers to but does not reproduce?

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

The Cyber Security Authority issued this Directive pursuant to sections 35 to 40 and 92 of the Cybersecurity Act, 2020. The Directive applies to all designated critical information infrastructure owners. A designated owner must appoint an accountable officer of senior management rank. A designated owner must review its approved cybersecurity policy at least once a year. A designated owner must conduct a quarterly cybersecurity risk assessment.

A designated owner must conduct yearly cybersecurity audits. A designated owner must create and keep a cybersecurity risk register. A designated owner must seek clearance from the Authority within one month before any major organisational change in operation, personnel and infrastructure. A designated owner must submit copies of reports covering audits, its risk register and any cybersecurity activities conducted, as the Directive requires.

An owner that fails to comply with a directive the Authority issues under section 92 of the Act is liable to an administrative penalty of not less than two hundred and fifty penalty units and not more than ten thousand penalty units.

When LexLint raises it

When your app profile says your app runs an essential service.

Back to the example  ·  Lint your app